Home
Docs
GitHub
Pricing
Blog
Log In

Run Sandworm Audit for your App

Get started
Hold on, we're currently generating a fresh version of this report
⚠️ This package seems to have moderate severity install script vulnerabilities

Affected script: "install-scripts:post-install-cmd"

The script is using PHIVE to install unknown package(s) and it has a potential security vulnerability as it forces the system to accept unsigned packages (--force-accept-unsigned). This means that any package, even if it's not signed by the authors, will be accepted and installed, which can lead to the installation of malicious programs. Additionally, the --trust-gpg-keys flag is used, which means it is blindly trusting specific keys. Without verifying these keys, this could allow a potential attacker to run arbitrary code on the system under the guise of these trusted keys.

Generated on Jun 6, 2024 via composer

sitepark/github-composer-release-test 1.7.0

Test project to test the release process with Github Actions
Package summary
Share
1
issue
1
high severity
meta
1
1
license
1
MIT
Package created
23 Oct 2023
Version published
20 Oct 2023
Maintainers
1
Total deps
1
Direct deps
0
License
MIT

Issues

1

1 high severity issue

high
via: sitepark/github-composer-release-test@1.7.0
Collapse
Expand

Licenses

MIT License

Permissive
OSI Approved
This is a human-readable summary of (and not a substitute for) the license. Disclaimer.
Can
commercial-use
modify
distribute
sublicense
private-use
Cannot
hold-liable
Must
include-copyright
include-license
1 Packages, Including:
sitepark/github-composer-release-test@1.7.0
Disclaimer

This deed highlights only some of the key features and terms of the actual license. It is not a license and has no legal value. You should carefully review all of the terms and conditions of the actual license before using the licensed material.

Sandworm is not a law firm and does not provide legal services. Distributing, displaying, or linking to this deed or the license that it summarizes does not create a lawyer-client or any other relationship.

Direct Dependencies

0
All Dependencies CSV
β“˜ This is a list of sitepark/github-composer-release-test 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.
NameVersionSizeLicenseTypeVulnerabilities

Visualizations